Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$300k for Cracking Telegram Encryption

telegram.org

Post reply on HN
Print view View original

11–20 of 94 posts

Re: $300k for Cracking Telegram Encryption

#11

Post by tptacek »

eksith wrote: post #10
tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

PR stunt has side benefits besides pure security even though the method has shortcomings. Namely, the PR part, which may play a significant role in its actual success. We know for a fact that most people aim for better known than just better.

There's the "well known" you get after holding a big contest, and the even better known you get after you're prominently featured in indictments, the way Hushmail and Lavabit were.

Not so many news stories about simple OTR.

Re: $300k for Cracking Telegram Encryption

#12

Post by [deleted] »

tptacek wrote: post #9
electic wrote: post #6

I give them, or anyone, credit for trying to create a secure messenger. It is not easy. However, I just wish they would release the source code to their clients and server. They have not. That would go a long way.

Both OTR (ChatSecure on your phone) and TextSecure are good options. Telegram is not a good option.

[deleted]

Re: $300k for Cracking Telegram Encryption

#13

Post by eli »

ilghiro wrote: post #7
tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

But without the PR stunt there wouldn't be PR?

Depends who your audience is. Personally I'm much more interested in a service with a successful professional audit than a gimmicky prize.

Re: $300k for Cracking Telegram Encryption

#14

Post by qwerta »

tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

$300,000 is nothing to sneeze at. I imagine someone could hack chat clients, extract private keys and claim the price.

Re: $300k for Cracking Telegram Encryption

#15

Post by asadlionpk »

tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

Moxie's blogpost about it http://www.thoughtcrime.org/blog/telegram-crypto-challenge/

Re: $300k for Cracking Telegram Encryption

#16

Post by WhitneyLand »

tptacek wrote: post #9
electic wrote: post #6

I give them, or anyone, credit for trying to create a secure messenger. It is not easy. However, I just wish they would release the source code to their clients and server. They have not. That would go a long way.

Both OTR (ChatSecure on your phone) and TextSecure are good options. Telegram is not a good option.

because...?

Re: $300k for Cracking Telegram Encryption

#18

Post by higherpurpose »

ropman76 wrote: post #5

Maybe restating the obvious, but why don't they pay out the 300k to some professional pen testers or cryptography auditors and publish the results. At least then they would have a shot at validity in this area.

"Security audit firm finds 9 flaws in Telegram" doesn't seem quite as a compelling as "Telegram is willing to give anyone $300k to 'break its crypto'".

Re: $300k for Cracking Telegram Encryption

#19

Post by eksith »

tptacek wrote: post #11
eksith wrote: post #10

Earlier quoted context omitted.

PR stunt has side benefits besides pure security even though the method has shortcomings. Namely, the PR part, which may play a significant role in its actual success. We know for a fact that most people aim for better known than just better.

There's the "well known" you get after holding a big contest, and the even better known you get after you're prominently featured in indictments, the way Hushmail and Lavabit were. Not so many news stories about simple OTR.

They don't have nearly as many users to face that indictment at this point in time, which is why they can afford to pull this. Like I said, there are shortcomings in this, but if anything, that does attract more attention to OTR.

Re: $300k for Cracking Telegram Encryption

#20

Post by remon »

tptacek wrote: post #3

Obligatory: https://www.schneier.com/crypto-gram-9812.html $300,000 isn't a whole lot more than it would cost to get n entire novel cryptosystem for a complex application built out of idiosyncratic components assessed professionally. They should just retain Riscure or Rambus to do that for them instead of the PR stunt. Previous thread about Telegram on HN, featuring Moxie Marlinspike: https://news.ycombinator.com/ite…

The big difference is that with one of the two options they don't actually have to spend the $300,000.
Post reply on HN